Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My boss just asked me to create a fictitious log entry to say that a user's account was updated before it was, to win a dispute.

I feel this is not right because I am trying to start a career in working with data technology. Whether or not I get caught, the integrity of my data will be questionable, and my character compromised.

What would be the best way to handle this?

I have a far more professional company wanting to pick me up, and they are willing to hold the position for me until I finish the project at my current job. We are roughly a month out; should I cut and run now?

Sorry this is a little off topic, but I know some established professionals frequent here, and just need to know the best way to go about handling this with character.

This question was IT Security Question of the Week.
Read the Mar 30, 2012 blog entry for more details or submit your own Question of the Week.

share|improve this question

migrated from programmers.stackexchange.com Jan 25 '12 at 19:00

This question came from our site for professional programmers interested in conceptual questions about software development.

28  
"Should I cut and run now?" What's stopping you from leaving? The request is unethical. Why not leave right now? What's preventing you? –  S.Lott Jan 25 '12 at 17:02
102  
You owe no loyalty to people who want to force you to commit fraud. –  quant_dev Jan 25 '12 at 17:27
27  
The request may be more than unethical, it is probably a civil wrong and could even be a crime. You should leave immediately and consult an attorney in order to protect yourself. –  jfrankcarr Jan 25 '12 at 17:27
2  
@FeralOink Back in Programmers.SE where it originated. This question applies to all developers who work with data, not just security professionals. –  Izkata Jan 26 '12 at 15:17
5  
+1 for giving this proper thought. Seen to many blindly following orders. –  Nils Munch Jan 31 '12 at 13:59

16 Answers 16

Ask your boss to put the request in writing before you do it.

Make sure to keep a copy of the request in your own personal files. Ideally a paper copy at home, or maybe an email in your own personal email account.

You say that you already have a better job to go to, so just give your notice now and leave the company as soon as the notice period is up. Presumably you have a notice period? A contract of employment?

If you don't have a better job to go to, then find one as fast as you can.

share|improve this answer
51  
+1 for getting it in writing. –  Bernard Jan 25 '12 at 17:05
8  
Make sure you document your refusal to perform the task as well as the request. And absolutely make sure you have a copy of this documentation at home. –  HLGEM Jan 25 '12 at 19:06
2  
@computer_nurd I recommend you talk it all over with someone you know & trust, not just us strangers! Anyway... Do you definitely know that the change is fabrication? In which case its possibly even criminal (fraud): don't do it. Or is it possible that the database is wrong due to operator error, and the boss has some paperwork (e.g. accounts dept) that proves it? –  MarkJ Jan 25 '12 at 19:38
3  
In which case, you don't necessarily ask for the paperwork, but you can say "this is an important change, I want to be sure I get it right, especially with this ongoing legal dispute. I don't myself know of my own knowledge what the true facts are, please can I confirm that this is what you want me to do. exact details here" Maybe in an email so the boss can just say yes. And so you have a record of what he said & when. Forward it to your Gmail or somewhere. If the boss is honest, he may be a little irritated but will do it. Otherwise don't change the database. –  MarkJ Jan 25 '12 at 19:42
1  
@Computer_nurd - Because it is a customer dispute. I think you need to consult a lawyer. If you are contracted through another company as your employer they may even have one for you to talk to for free. You may have obligations now because your boss involved you. Failure to meet those obligations could cost you. Talk to a lawyer ASAP. –  Chad Jan 25 '12 at 20:13

This is wrong and you should tell your boss that it is wrong. It's not reason enough to leave your job unless your current employer isn't willing to discipline your boss in any way for trying to deceive a customer. If they don't take this seriously, you should move on. No sense in working for a company that allows this practice.

share|improve this answer
9  
Good point. In other words: if your boss is willing to do this to a client, xe'll be perfectly willing to do the same to you, and/or pin the blame on you when excrement collides with ventilator. –  Piskvor Jan 25 '12 at 17:13
    
My boss is the president...no discipline. –  computer_nurd Jan 25 '12 at 17:14
1  
@computer_nurd: Then you should just leave. –  Bernard Jan 25 '12 at 17:36
1  
@Piskvor that is why the OP gets everything in writing and then sends it offsite to an account the his company can't manipulate before quitting. –  Jetti Jan 25 '12 at 18:05

Don't do it. I did something unethical once for an executive and I am still troubled by it to this day. For legal reasons I cannot tell anybody.

It is unethical and you have another job lined up. Don't let him bully you. If he fires you then make sure you have in writing his request and you have legal grounds to sue for wrongful dismissal in most jurisdictions. That would be a pretty cut and dry case and you would make out greatly if he were to fire you, especially since you can just show up at the other job and not miss any income.

I would talk to an attorney who specializes in employment law too, most will give you at least a half-hour consultation for free.

Don't make the same mistake I did.

share|improve this answer
4  
Thanks for the reply from experience. I will not do it. Time to start getting the change in motion! –  computer_nurd Jan 25 '12 at 17:31
9  
Really don't do it, this is one of those times where putting your badge on the desk and walking out the door would be a reasonable move. Depending on what is in that log doing so MIGHT even be a criminal act. So I would say NO and not budge an inch –  Zachary K Jan 25 '12 at 18:22
2  
Make sure you have as much documentation as you can (in a location outside of work) just in case your boss tries to throw you under the bus. But get out of their as soon as possible one way or the other. –  Zachary K Jan 25 '12 at 18:26
5  
My opinion is to take from the top two questions. Get the request in writing, THEN refuse to do it. You have a job lined up and it'll be hard for you current employer to blackball you when you have proof of such a request. –  user606723 Jan 25 '12 at 19:40
4  
@user606723 "Get the request in writing, THEN refuse to do it." Lying to a liar doesn't make you honest. I get the impression that it's a "Put it in writing to Cover My Ass and I'll do it" then don't do it... not exactly keeping the high ground on that route. –  WernerCD Jan 26 '12 at 22:59

Does your company have an ethics officer, internal auditor or internal council? If so, then you should contact that person, explain what you have been asked to do (in writing), and let them handle it. If it is a small company without any of these positions, then take your concerns to the owner/president (also in writing).

As far as your company is concerned, this is the best way to handle this. The possibility exists that your boss is acting on his own and against company policy; this would allow your company to deal with him in an appropriate fashion. If you don't do this, your company could claim that they never knew anything about it and that you must be the problem. After all, with the level or integrity that your boss seems to have, he may deny ever asking you to do this.

You have nothing to lose, as you are planning on taking a new job anyway.

share|improve this answer
4  
+1 for this as it is the right thing to do. If people don't get called out for unethical actions, then they are just going to do it again and again. "All that is necessary for the triumph of evil is that good men do nothing" –  mikera Jan 26 '12 at 3:53
1  
but please just in case talk to your boss, maybe he is too wrapped up in winning that he does not realize that he is cheating to win. Just make sure he realizes what he is asking. –  Arjang Jan 26 '12 at 12:48
1  
@Ramhound - "The act deals with accounting." No, the act deals with a crime (depending on the legal and moral climate you work in). Falsification of records is a serious issue in some places. Asking an employee to do it can expose them to legal consequences. If "your boss" is ready to have you commit a crime in order to "win", then get away from him/her as quickly as possible. –  robrambusch Jan 26 '12 at 16:07

It is never worth doing something unethical. You need to live with yourself. Professional programmers should always be PROFESSIONAL, and part of that is always acting with integrity! If your boss' action is typical of the rest of the organization, it may be time to look for another position.

share|improve this answer
    
This. You are new to your career, so it's easy to feel like your employer "owns" you, and that you must do whatever they ask. As you grow and change jobs, you will begin to feel more like a professional: an independent, skilled worker who sells his/her services to employers. If you see yourself that way, there's no reason to feel pressured to do anything unethical. You aren't trapped by this employer's wants. You are free to sell your services to someone else. –  Nathan Long Jan 27 '12 at 16:25
  1. Save a copy of the current logs and encrypt
  2. Get the request to falsify in writing
  3. Do not make changes to the logs

What to do after this point is up to the legalities you are subject to. I would be sorely tempted to inform the other party of the request and offer them the unmodified logs.

share|improve this answer

Do yo work for a publicly traded company or otherwise fall under SOX? If so, could get yourself into a world of hurt.

share|improve this answer
    
Not sure why someone thought pointing out SOX compliance is worth a vote down. –  Wayne In Yak Feb 1 '12 at 18:53
  1. If you have your boss' request in writing in any form (paper, e-mail, etc.), make a copy for yourself that can be stored somewhere outside of your boss' control. Depending on the sensitivity of the information stored in the logs he's requested you to modify, you may also want to keep your own copy of the logs. (This is to say: If the logs have any data that is too sensitive, you probably should not be exporting them.)

  2. Consult a lawyer with experience in this field. Depending on what implications your log changes may have, it could be something that eventually comes back to bite the boss in the end. If that happens, and even if you actually didn't make the changes yourself, then you could be on the hook as well under "accessory" or "conspiracy" charges if you fail to report it to authorities. Find out what is necessary to protect yourself from this, and do it - even if it does mean reporting your boss.

  3. Don't make the requested log changes. It's not worth it.

  4. Get away from that company as soon as you can. You may want to get your lawyer's opinion on how quickly you can do this without putting unnecessary contractual burdens on yourself, but do not let that project be your only reason for staying.

  5. If your new employer asks why you're suddenly leaving so soon, you may cite an ethical disagreement with upper management and leave it at that. Again, consult with your lawyer as to how much or little detail you should disclose.

share|improve this answer
4  
Its possible that the actions of his boss may negate any contractual burdens on the OP. Another reason to consult a lawyer. –  Chad Jan 25 '12 at 20:15
1  
If the request is recorded (you have written documentation for proof) and is for the sake of fraud, calling the Attorney General would be the an appropriate action in the US. –  Jeff Ferland Jan 26 '12 at 2:23
    
@JeffFerland - Seriously? I think calling the Attorney General for a private issue between Company A and Client A is a little overkill. The Attorney General serves the public. Lets start a couple pegs down the ladder shall we before we involve the Attorney General. –  Ramhound Jan 26 '12 at 12:47
    
@Ramhound In this case of a publicly-traded company, it's not just Client A that's being infringed upon. The AG probably isn't a bad place to start. At the very least, they'll tell you where you should go if it isn't them. –  Iszi Jan 26 '12 at 13:24

Do not do it. Even in writing it does not matter. At the end of the day its your butt on the line. If you're boss asked you to shoot someone with a gun, and you got him to write permission in writing, do you think anyone in the court would care if your boss gave you permission or not?

Regardless, you will be held accountable, not your boss. If your boss has a problem with it tell he or she that you would be perfectly happy writing a letter as to why you are not comfortable doing so.

This is actually entrapment, forcing you to break a law, but if you pull the trigger it will be on you, not your boss. If its a serious issue, you would want to report the entrapment.

share|improve this answer
2  
Entrapment would require that the OP's boss was a law enforcement officer. –  Blrfl Apr 7 '12 at 18:40

Does he realize what he is asking? If he is focused on winning the dispute then tell him this not the way to win, it is cheating and any/all types of benefits from such an act is meaningless.

This is not only your problem, at times people become so focused on something small that completely forget themselves, in times like that a good shepherd has to bring them back to the flock.

He needs your help, but not in doing what he is asking from you, but in the way of moral guidance. This is not just a case of doing or not doing something wrong cause someone asked you to do it, it is a case of making them realize what they are asking, and if this gets done ( by either you or your replacement ) they would lose a part themselves forever.

Maybe the Ivy league or private school he went to made him thinking winning is everything, but even his mum can tell him this is wrong. Just tell him you are gonna tell his mum if he goes on with it, then tell him if that would make him feel ashamed then maybe it is not something he should be doing.

If after all your guidance it still doesn't change, then walk away, no job worth a stain on your soul.

share|improve this answer
3  
I've been in this situation and honestly, the boss is probably just afraid of the auditors. I spoke with the auditor's bosses in an abstract way about findings and remediation, then spoke to my boss about it. We admitted fault, flubbed the audit, posted a remediation plan and put it in place. That's what the process is for. Seeing it work put emphasis on fixing our processes, made everyone happy and took a lot of stress out of future audits. If the environment is too toxic for that kind of action, then a new job is not a bad idea :-( –  mgjk Jan 26 '12 at 17:57

The idea of getting it in writing is a good one, but if he isn't the "pointy hair dude" he is never going to do it.

If this gets out, you are associated with it no matter if you did it or not (be sure that there will be someone to do it). So, if you can, cover yourself as best you can, and leave as fast you can. I know, this seems cowardly, but from personal experience is better than making a fuss about it. You see, he got there by employing the same tactics, and he won't hesitate to use them to fsck you if you cross his way (or just for fun).

Never fight morons, they will drag you at their level and beat you with experience.

Tell me with whom you walk and I'm going to tell you who you are.

(these are losely translated from my mother tongue, but I hope you get the picture)

Best of luck to you, on your new job!

share|improve this answer
2  
I think your answer is more realistic. You have to know who you are dealing with. Advising people to behave as if everyone had ethics can lead them into dangerous situations and adverse results. –  DOK Jan 31 '12 at 18:35

I'm once in a similar situation (it's not about log data, but deal with ethics nonetheless)

Some of the answers mention about asking your superior to put the request in writing. That sound good and nice. But it is important to know your country culture and your boss intelligence as well.

For my case back then, my superior was intelligent enough to sense my plan of protecting myself while possibly putting him in danger(it was actually so obvious the moment you request/hints at getting something in writing), I don't want to get into the details, but things are changed and I'm removed very swiftly without me expecting it to be that fast. It was painful and depressing.

Also if such a culture (of covering up) is common in your country, your future employers knowing about it (I don't know about you, but over here, some companies job applications forms require you to state whether you have been fired or forced to resign before and state the reason) might view this as a negative trait rather than something positive.

In fact, there is this local news recently about a previously highly paid engineer who has been working as a rag and bone man for some years to support his family ever since he was 'laid off' after whistle blowing on his company. Even after the news is reported, he was still unable to get a proper real job (due to age, over qualified.etc) and that is a possible consequence one has to think about too.

Bottom line is, it's good to consider the ethical aspects of it, but do think of the bigger picture too. Can you afford to lose this job in your current circumstances? What is the current situation? is this really serious? Any backup plans?.etc

Also, consider getting proofs in less obvious ways such as instant messaging your superior, e.g. ('I kind of forgotten, so just to confirm, modify this xyz record to 5?') and the moment he reply to this instant message on skype.etc, you have a record already.

Still, if the conclusion is that you rather lose the job than to do such a terrible crime, then be the one who resign. At least you will feel better in the sense that it is you who ditch your superior, not the other way round.

Regardless of whether you will do it anot, try to plot your escape as soon as possible.

share|improve this answer
3  
It's actually nicely written. Reporting on your superior and doing the right thing may cause unexpected things to happen. Even if you are right and lawful your potential employees may see it as potential threat (we can't trust him at critical situations). You're also right on the alarm bells ringing when someone ask you to write it in a email... –  MadBoy Jan 27 '12 at 13:06

As a professional, or at least if you ever want to be one, you should learn to say 'no' even if it costs you your job. Reading the popular answers about putting request in writing - sure, you can do so to cover your ass, but in my experience showing spine pays off way more than covering your ass.

In the long run, spine is always stronger than a piece of paper.

Regardless of the country you're in - you're a person with a choice. Even if you were eaten you always have 2 "exits".

share|improve this answer

First, quit and go to your new job. Leave on as good terms as you can. When asked why you are leaving, say something harmless about what a great opportunity the new job is.

Second, once you're gone and have started your new job, report your old boss. If your company has some sort of ethics process - make the report there (it can be anonymous but in this case it's obvious who is doing the reporting). If there is no ethics process in place and this is a big company you might try the audit committee. As a last resort, there's either his boss or HR. In a small company, there's the CEO or the owner.

Remember that companies in general try to avoid trouble and smooth things over. The suggestion to consult an employment lawyer is a good one.

Do not put yourself in the position of reporting your boss while you work there if you can avoid it. These situations often do not work out well.

You should check with your lawyer to see if saving a copy of the original log somewhere on your company's system (NOT taking a copy with you) is a good idea.

share|improve this answer
1  
+1 for saving the current log. You can email it to yourself at your work email address. The company would be in a world of hurt if they deleted the email if they conform to Sarbanes-Oxley (look it up). (Section 802: "... fines of up to $1,000,000 and/or prison terms for 'whoever knowingly alters, destroys, mutilates any record or document with intent to impede an investigation.'" :) –  Jim Jan 26 '12 at 7:25
1  
@Jim: That's already the case for altering logs (as proposed here), you don't need to email them just to achieve SOX status. –  MSalters Jan 26 '12 at 9:38
    
@Jim - What sort of investigation exactly? Making mention of random laws that might not even apply to the author is in poor taste. The act deals with accounting. This sounds to simply be a private dispute between a company and a client. –  Ramhound Jan 26 '12 at 12:49
    
Emailing logs to yourself? Bad idea. Leave them alone, do not touch them, do not log into the relevant servers, don't get anywhere near this with a ten foot pole. –  Chris Lively Jan 31 '12 at 16:48
    
@Chris Lively - "Emailing logs to yourself? Bad idea" - And not anything I suggested you may notice. –  robrambusch Feb 1 '12 at 2:12

I had a similar case where I was asked to cover up a code theft.

I consulted an attorney who told me that the best for would be to just leave the company and forget it. What I did was to talk with my manager and make sure he understand that this is bad thing and that I'm against it and to hear him telling me to do it anyway. ALL THAT RECORDED with my smartphone. My plan was to resign and to ask for compensation otherwise I'd publish the whole thing but a day after the recorded meeting the boss told me that he thought about it again after our meeting and that I was right. So nothing happened and nobody knows about the recording.

share|improve this answer
10  
You seriously just admitted to attempted blackmail? –  Naltharial Jan 26 '12 at 12:08
1  
What you describe in MANY states would have been illegal. In Florida for example you cannot record a conversation you have with somebody unless they give you permission. So not only would you have been charged with Blackmail, you would have been charged with recording the conversation also, using vulgar language is really in poor taste. What you did was even worse then what your boss requested you did. –  Ramhound Jan 26 '12 at 12:55
1  
no, its only you who didnt seriously listen. i recorded it only in case i had to resign my work because of that. in that case having a recording makes the legal part much easier and cheaper. instead of having to prove my point to the judge i've a recording and the trial end in 2 days. thats it. in my country theres a protection under the law for employees that report corruption in the place of work. and so the recording is the proof. no blackmail at all :) –  baba smith Jan 26 '12 at 14:16
4  
+1 for blackmail - nothing like committing a felony while complaining about one... –  Jim B Jan 26 '12 at 16:40
3  
recording a conversation that you're part of it is just another technology for 'taking notes'. so as far as i know in the US you can do that. its illegal to record a conversation which you're not part of it - this is tapping. –  baba smith Jan 26 '12 at 16:56

The absolute first thing you should do is hire a lawyer. Do not pass go, do not collect your check, do not speak to your boss or anyone else at that company UNTIL you have spoken with an attorney. Go ahead and pay their retainer.

At this point there are a lot of different things that could cause you to go to jail, depending on where you live.

In some places it is a crime to simply ignore/not report one. If this is the result of a criminal investigation your ass could land in hot water for simply turning the other way, let alone actually doing what the moron asked you to.

If it's the result of a records request caused by a civil litigation and you don't tell the company attorney about this, it could bite you. It might bite you if you don't tell the opposing counsel... Ask a lawyer what to do. Regardless falsifying ANY data submitted to a court is grounds for criminal proceedings against you.

Another tact: What if someone overheard your boss making this request of you and reported it? You could be in trouble for simply not doing anything.

At the end of the day it's entirely possible that the boss in question either modifies those records him(her)self or has someone else do it and blame you if caught. Given the bosses lack of ethics I wouldn't put it past them.

Point is, get a lawyer right freaking now.

share|improve this answer

protected by Rory Alsop Jan 26 '12 at 8:31

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?